<format>
  <regular-grammar>
    <head-re><![CDATA[^ # every message starts from new line
(?<source>.+)\ # log source name
(?<type>Critical|Error|Warning|Information|Verbose|Start|Stop|Suspend|Resume|Transfer)\:\  #severity
(?<eventId>\d+)\s*\:\s* # event number (of ID)]]></head-re>
    <body-re><![CDATA[^ # stick to the beginnig of log range
(?<body>[\s\S]*?) # non-greedy matching for any charachters
(\s*ProcessId\=(?<process>\d+))? # there might be process id - dec number
(\s*LogicalOperationStack\=(?<opStack>[^\r\n]*))? # there might be operation stack
(\s*ThreadId\=(?<thread>\d+))? # there might be thread id - dec number
(\s*DateTime\=(?<date>\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d+Z)) # datetime
(\s*Timestamp\=(?<ts>\d+))? # timestamp
(\s*Callstack\=(?<stack>.*))?
\s*
$]]></body-re>
    <fields-config>
      <field name="Time"><![CDATA[TO_DATETIME(date, "yyyy-MM-ddTHH:mm:ss.fffffffZ")]]></field>
      <field name="Body"><![CDATA[body]]></field>
      <field name="Thread"><![CDATA[(!process.IsEmpty ? (process + " - ") : "") + thread]]></field>
      <field name="Process"><![CDATA[process]]></field>
      <field name="Severity" code-type="function"><![CDATA[switch (type)
{
case "Critical":
case "Error":
	return Severity.Error;
case "Warning":
	return Severity.Warning;
default:
	return Severity.Info;
}]]></field>
      <field name="EntryType" code-type="function"><![CDATA[switch (type)
{
case "Start":
	return EntryType.FrameBegin;
case "Stop":
	return EntryType.FrameEnd;
default:
	return EntryType.Content;
}]]></field>
      <field name="Source"><![CDATA[source]]></field>
      <field name="EventId"><![CDATA[eventId]]></field>
      <field name="OpStack"><![CDATA[opStack]]></field>
      <field name="Timestamp"><![CDATA[ts]]></field>
    </fields-config>
    <patterns />
    <encoding>utf-8</encoding>
    <plain-text-search-optimization allowed="yes"/>
  </regular-grammar>
  <id company="Microsoft" name="TextWriterTraceListener" />
  <description>Log files that are created with .NET class TextWriterTraceListener.</description>
</format>